VPN configuration under a Dual-WAN infrastructure ?

If you want to do remote administration of the xg why not use central?
ian

Hello,

I don’t want to open a backdoor on my network. 

Opening the XG front door by using a VPN is more secure eg exposing it to the internet so?

Ian

If you don't have a static IPv4 on both WAN interfaces you will need to use DDNS for both, but if one of the WAN IP's are static you only need DDNS for the secondary WAN.

If you already have a domain you can check if the DDNS provider is available on the Firewall, if not (and since you're a home user) you can either use DNS-O-Matic or migrate your domain DNS to Cloudflare.

J Thai said:

The Sophos XG Firewall supports several types of VPN, I am looking at the possibility of deploying an SSL VPN by TCP protocol for the ease of use and commonality. Will this work for me ?

With DDNS, yes. (And if you can use SSL VPN (OpenVPN) with TCP at 443.)

Just a reminder, on the SSL VPN configuration you need to use your static IPv4 (If available), then edit the config and manually add the secondary remote; Example:

remote 1.1.1.1 443 tcp-client
remote vpn.domain.com 443 tcp-client

Interesting question. Thanks for having asked me that.

With Sophos Central, Sophos is in charge of my everything.
With the VPN, I myself am in charge of my everything.

From an digital security perspective, which one should I prefer ?

I was very skeptical of Sophos Central initially, but: a) VPN'ing in to the firewall directly is more complicated than you might think in terms of trying to administer the firewall as if you were local, b) Sophos Central has a lot of convenient features, and in my case c) Sophos Central's wireless administration gives some additional features to Sophos APs that you don't get from local administration.

That was a healthy suspicion until you fell for the convenience of their remote control service.